The data behind configuration of all of these resources is kept in the ci-configuration repository.
The files in this repository are intended to be self-documenting, but one of particular interest is projects.yml, which describes the needs of each project.

Translation of ci-configuration to Taskcluster resources, and updating those resources, is handled by ci-admin.
This is a small Python application with commands to generate the expected configuration, compare the expected to actual configuration, and apply the expected configuration.
Only the apply subcommand requires elevated privileges.

This tool automatically annotates all managed resources with “DO NOT EDIT”, warning users of the administrative UI that changes made through the UI may be reverted.

To change Taskcluster configuration, make patches to ci-configuration or (if necessary) ci-admin, using the Firefox Build System :: Task Configuration Bugzilla component.
Part of the landing process is for someone with administrative scopes to apply the resulting configuration.

You can test your patches with something like this, assuming . is a checkout of the ci-configuration repository containing your changes: